Read the docs
TI-2026-26231 Aliases CVE-2026-33870GHSA-pwqr-wmgm-9rr8

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Priority HIGH 72CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 17 fixed, 15 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00701 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.1.132.Final, 4.2.10.Finalio.netty:netty-codec-http (Maven): 4.1.132.Final, 4.2.10.FinalRed Hat: 18 advisoriesRed Hat: 17 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.132.Final; 4.2.0.Alpha1 to before 4.2.10.Final4.1.132.Final, 4.2.10.FinalPatch availableCNA
—io.netty:netty-codec-http (Maven)before 4.1.132.Final4.1.132.FinalPatch availableGHSA-pwqr-wmgm-9rr8
—io.netty:netty-codec-http (Maven)4.2.0.Alpha1 to before 4.2.10.Final4.2.10.FinalPatch availableGHSA-pwqr-wmgm-9rr8
  • netty Vendornetty Affected before 4.1.132.Final; 4.2.0.Alpha1 to before 4.2.10.Final Fixed in 4.1.132.Final, 4.2.10.Final Patch available CNA
  • io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.132.Final Fixed in 4.1.132.Final Patch available GHSA-pwqr-wmgm-9rr8
  • io.netty:netty-codec-http (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.10.Final Fixed in 4.2.10.Final Patch available GHSA-pwqr-wmgm-9rr8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.132; 4.2.0 to before 4.2.10Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.132; 4.2.0 to before 4.2.10 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.132.Final, 4.2.10.Final
  • Fix · GHSA-pwqr-wmgm-9rr8 io.netty:netty-codec-http (Maven) Fixed in 4.1.132.Final Advisory →
  • Fix · GHSA-pwqr-wmgm-9rr8 io.netty:netty-codec-http (Maven) Fixed in 4.2.10.Final Advisory →

Red Hat 18 advisories

  • RHSA-2026:69459 Released 2026-09-21 · Red Hat rating Important
    AMQ Clients 2026.Q3
    • AMQ Clients 2026.Q3
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
Show 15 more Red Hat advisories
  • RHSA-2026:22619 Released 2026-06-02 · Red Hat rating Important
    Red Hat Data Grid 8.6.1 security update
    • Red Hat Data Grid 8.6.1
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7
  • RHSA-2026:17668 Released 2026-05-14 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
  • RHSA-2026:14276 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.7 release and security update
    • Red Hat AMQ Broker 7.12.7
  • RHSA-2026:14272 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.5 release and security update
    • Red Hat AMQ Broker 7.13.5
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:10175 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.1 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8
  • RHSA-2026:8509 Released 2026-04-16 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.0 release and security update
    • Red Hat AMQ Broker 7.14.0
  • RHSA-2026:8159 Released 2026-04-14 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.GA)
    • Red Hat Build of Apache Camel 3.27.1.SP1 io.netty.netty-codec-http-4.1.128.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.128.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.22.redhat-00001.jar
  • RHSA-2026:7109 Released 2026-04-14 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.6 release and security update
    • Red Hat build of Quarkus 3.20.6.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
  • RHSA-2026:7380 Released 2026-04-14 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3 release and security update
    • Red Hat build of Quarkus 3.27.3.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
AMQ Clients 2026.Q3Fixed RHSA-2026:69459
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Red Hat AMQ Broker 7.12.7Fixed RHSA-2026:14276
Red Hat AMQ Broker 7.13.5Fixed RHSA-2026:14272
Red Hat AMQ Broker 7.14.0Fixed RHSA-2026:8509
Red Hat Build of Apache Camel 3.27.1.SP1Fixed RHSA-2026:8159
Red Hat Data Grid 8.6.1Fixed RHSA-2026:22619
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:65126
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:10175
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14Fixed RHSA-2026:17668
Red Hat build of Quarkus 3.20.6.redhatFixed RHSA-2026:7109
Red Hat build of Quarkus 3.27.3.redhatFixed RHSA-2026:7380
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
Not affected: 13 products
  • Cryostat 4 on RHEL 9
  • Red Hat Build of Apache Camel 3.27.1.SP1
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.20.6.redhat
  • Red Hat build of Quarkus 3.27.3.redhat
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33870
  2. 2026-10-03 Alias added: GHSA-pwqr-wmgm-9rr8
  3. 2026-10-09 Fix available: RHSA-2026:8159 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:8509 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:14272 · Red Hat
  6. 2026-10-10 Fix available: Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat Build of Apache Camel 3.27.1.SP1 · Red Hat
  7. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  8. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA, Red Hat build of Quarkus 3.20.6.redhat, Red Hat build of Quarkus 3.27.3.redhat · Red Hat

References

Exploit 1

Advisory 1

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences